#116: Prism runtime on T3 only; models and limits from the T3 snapshot

[lukemaj]

Closes #116 (stream B of spec #115). Closes #110. Supersedes the remaining #111 fixes (1, 2, 3 and 6 by deletion or the snapshot; 4 and 5 implemented here).

What changed

• T3 is the only execution path (Delete the legacy harness execution path once jobs run as T3 threads #110). submit requires --planner-t3-thread; dispatch, resume, worker, correction and recovery turns, planner questions and the terminal report all run through T3. --planner-harness/--planner-model/--planner-effort are recorded as evidence only.
• Models, limits and role preferences come from the T3 snapshot (GET /api/prism/snapshot, contract from Prism in Chromeria: MCP toolkit, spawn_thread(role), role settings schema, provider snapshot endpoint chromeria#19 feat/19-prism-toolkit, runner/t3snapshot.py), read before each controller step and cached for 30 s:
  • A route is eligible when its instance is enabled and offers the model, so turning a model off removes it.
  • A non-empty Prism (role, lane) list replaces the policy order. Lanes map easy/medium/hard to small/default/hard, and entries without a policy route run as t3:<instance>:<model>@<effort>.
  • A usage window at 100 % rests every route on that meter until resetsAt, or until a later read when the window has no resetsAt. 80 % degrades.
  • A 404 or unreachable snapshot filters nothing, so the runtime still works on today's Chromeria.
• Error marks expire at their reset: OpenCode's next (epoch ms), resetsAt, retry_after, else one assumed 5 h window. Prose is never parsed. Exhaustion rests the whole pool, so a Go limit never moves laterally within Go. A success clears assumed marks on its pool.
• Jobs on 2026-09-25 failed on router misclassification, not model work: stale Zen free mark, Go limit read as overload, false Grok stalls, red base proof #111 fix 4, baseline proof: the task's proof runs once on base_commit before the first dispatch. It runs in place when the workspace is clean at base, else in a scratch worktree that is removed afterwards. A red base blocks as baseline_proof_failed before any thread starts; "baseline_proof": false opts out.
• Jobs on 2026-09-25 failed on router misclassification, not model work: stale Zen free mark, Go limit read as overload, false Grok stalls, red base proof #111 fix 5: a capacity signal on the correction route moves laterally into the job's lane.
• Planner evidence from router-80-release-t3: the dispatcher's evidence carries the job branch's commits since base and any open branch PR, so finished work is not read as "no changes, no PR".
• Found while porting tests:
  • An exhausted escalation now asks the planner in its thread on the next step. Before, it waited for a manual recover.
  • The T3 dispatch fallback now reserves the capped luna-go/max route before starting its thread.
• Skill removed: skills/model-routing and its generated reference are gone. The plugin manifests now carry just the runtime; usage guidance lives in the Prism tool descriptions.
• VERSION 0.34.0 → 0.35.0, policy 2.9.0. The live proof job router-80-release-t3 is terminal (cancelled), so the release hold is lifted.

Deleted

Runner code went from 21 688 to 10 031 lines; tests from 22 631 to 6 596. The diff is 71 files, +2 983 / −31 817.

• Whole files: runner/harnesses.py (2 624), runner/supervisor.py (1 251), runner/kits.py (925), runner/direction.py (438), worker-kits/grok/ensure.py (182), skills/model-routing/* (128).
• Within files: adapters.py −1 220 (keeps only the dispatcher prompt, envelope parsing and redaction), core.py −2 755 (child invocation machinery, probes, readings), controller.py −2 386 (CLI dispatch and resume, harness callbacks, busy checks, CLI terminal senders), policy.py rewritten (Go cost tables, tiers, host-only routes, kits, reset-prose parsing).
• 29 test files that covered only the deleted path were removed. The surviving behavior is ported onto an in-memory T3 fake (tests/fakes.py, tests/test_t3_only.py): terminal reports, capacity moves, the ladder to the planner, report redaction and diffs, and cross-job capacity.

Proof

• python3 scripts/test.py: 249 tests OK. python3 -m compileall -q runner scripts tests: OK. python -m runner.policy validate: OK. scripts/test.py now points the suite at a /tmp T3 home and a closed port, so it can never reach the user's T3.
• New tests:
  • tests/test_t3snapshot.py (fake HTTP server plus fake client): model or instance off, lane lists, the 100 % / 80 % / passed-reset / no-reset windows, 404 unknown, Zen free next expiring, Go limit resting the pool and moving to Grok Build, success clearing an assumed mark.
  • tests/test_issue116.py: baseline proof fail/pass/restart/scratch/skip on real Git repos, correction fallback, branch evidence.
• Not verified live: no job ran against a T3 server serving the snapshot, because stream A isn't merged or installed. Routing was checked only against the contract source and fakes.

Not done here

• "Rerun a single failing test once before counting a proof failure" (planner comment): the proof is an opaque shell command, so this needs per-framework test identification. The baseline check covers failures that already exist on the base. Suggest a follow-up issue.
• The snapshot is refreshed per controller step, not at submit: the submit route is provisional, and the first worker preflight re-checks it.

🤖 Generated with Claude Code